| タイトル | eladmin 2.7 Improper Access Controls |
|---|
| 説明 | The PUT /api/roles endpoint in eladmin v2.7 contains a critical authorization bypass vulnerability where attackers caneither demote high-privileged admin roles or escalate data access permissions by exploiting insufficient validationin the getLevels() method, which only checks if the submitted level value is greater than or equal to the user'scurrent level without verifying the target role's original permissions, allowing lower-privileged users (e.g.,level=3) to modify higher-privileged roles (e.g., level=1) by submitting a request with a level matching their own,while completely omitting the level field bypasses all checks and lets attackers arbitrarily modify the dataScopefield to "全部" (all data access) or other values, effectively enabling privilege escalation, unauthorized roledemotion, and global data access through direct manipulation of these unprotected parameters. |
|---|
| ソース | ⚠️ https://github.com/elunez/eladmin/issues/898 |
|---|
| ユーザー | AliceS614 (UID 94277) |
|---|
| 送信 | 2026年04月24日 16:24 (5 月 ago) |
|---|
| モデレーション | 2026年05月23日 08:31 (29 days later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 361917 [eladmin 迄 2.7 Users API Endpoint UserController.java checkLevel 特権昇格] |
|---|
| ポイント | 0 |
|---|